CVE-2026-87106 PUBLISHED

Consul vulnerable to a denial of service in the native RPC listener

Assigner: HashiCorp
Reserved: 08.09.2026 Published: 10.09.2026 Updated: 10.09.2026

Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	HashiCorp
Product	Consul
Versions	Default: unaffected affected from 1.21.0 to 2.0.4 (excl.)

Vendor	HashiCorp
Product	Consul Enterprise
Versions	Default: unaffected affected from 1.21.0 to 2.0.4 (excl.)

Credits

This issue was reported to HashiCorp by Yazdan Soltani.

References

https://discuss.hashicorp.com/t/hcsec-2026-35-consul-vulnerable-to-a-denial-of-service-in-the-native-rpc-listener/77737

Problem Types

CWE-400: Uncontrolled Resource Consumption CWE

Impacts

CAPEC-130: Excessive Allocation